Recent version(s) overwrites /usr/local/etc/nginx/conf.d/nextcloud.conf on jail restart

[eikehein]

I've made some modifications to /usr/local/etc/nginx/conf.d/nextcloud.conf inside my plugin jail using iocage console. This has served me well up until now and across several prior upgrades. However, as of a recent upgrade to 22.2.0, nextcloud.conf is being reverted to the default contents on every restart of the plugin jail.

Several other TrueNAS users have observed and had trouble with the same behavior: https://www.truenas.com/community/threads/ssl-change-after-nextcloud-reboot.95672/

I suggest this is a regression.

[asw2012]

I am having the same issue. I edit the nextcloud.conf file then I need to restart the plugin, it reverts back to the original.

Please help

[sonicaj]

@eikehein if i follow correctly, you want to modify the configuration file in order to enable SSL ? If yes, we have instructions for those steps here https://github.com/freenas/iocage-plugin-nextcloud/tree/12.2-RELEASE ( README ). Please let me know if you have another use case in mind apart from that ? Thanks!

[asw2012]

@sonicaj I see the link to the instructions, thank you. But under the Network Properties tab, there is no field for "Protocol" / "Jail Port Number" / "Host Port Number".

[sonicaj]

@asw2012 i suppose the jail in question is not using NAT and is instead using DHCP / static IP ?
That only applies to NAT

[asw2012]

Yes, using static IP address. But, as I mentioned, I have the problem of the nextcloud.conf file being overwritten.

[suckerface]

I'm also running into the restore issue with nextcloud.conf using static/DHCP. Additionally, and probably related, the certificate generated with certbot --nginx also has to be reinstalled every time the jail is rebooted.

[sonicaj]

@asw2012 with static IP, you don't have to do the port forwarding as it's not valid. About the configuration file being overwritten, why is it being modified when the certificates can be generated as specified in (https://github.com/freenas/iocage-plugin-nextcloud/tree/12.2-RELEASE ) ?

[suckerface]

@sonicaj for sanity sake, I tried following those steps linked, specifically under TLS Certificates (which I already have using certbot), however I have no generate_letsencrypt_certificate script in my PATH, only generate_self_sign_tls_certificates, which I do not want to do. I have my cer and pem files in /usr/local/etc/letsencrypt/live/truenas, as well as my domain added to known hosts in /usr/local/www/nextcloud/config/config.php, however restarts lose that certificate. running a reinstall works (Successfully deployed certificate for to /usr/local/etc/nginx/conf.d/nextcloud.conf) but restarts, again, wipe that file, and (probably unrelated) throw a "too many redirects" error.

[suckerface]

I completely removed the plugin/jail and started from scratch. This time the generate_letsencrypt_certificate script was present, and I was able to successfully follow the instructions listed above (after editing the script to change mkdir --parent to mkdir -p). No editing of the nginx nextcloud.conf file was required.

[eikehein]

So from the linked README there's now a way to generate new certs during install, but what I've actually been doing is to supply my own certificate files and related config. How am I supposed to do this in a supported manner - generate certs and replace them?

Background: My Nextcloud jail is accessible on the internet, by way of a domain pointing at the static WAN IP of my router, which forwards 443 to a port on my TrueNAS that's mapped to the jail. The process of generating and updating certs for the domain is a separate affair, and then I need to carry them into the jail.

The jail plugin is super neat and handy otherwise and saves me a lot of effort, so I'd love to keep using it. Maybe some supported means to supply custom certs?

[suckerface]

@eikehein I was doing the same thing, more or less, down to the cert generation. I just put it in the hands of the script in the plugin (which uses Let's Encrypt in basically the same way I was already doing), which creates and attempts to auto-renew weekly. It was much easier to just switch over vs fighting with or creating a cron job to make the changes on reboot.

Is there a particular reason you're needing to use an "external" cert?

[eikehein]

Well, I'm not using LetsEncrypt for the cert ... :-) It's not the only CA.

[suckerface]

Assuming that the certificate format and such is the same, I'd try doing a clean install, per the instructions, while generating the certs with the supplied script, and then swap out your cert with the generated one. If I have some time this weekend, I can do a quick test to help you troubleshoot.

[mgob]

The file itself, with no modifications is broken for LDAP/AD configuration so, excluding the SSL/Static IP configuration, it's bad to begin with and needs modification if you want to use SSL outside of the included SSL/LE utilities for various reasons OR you want to use LDAP/AD.

Modification of this file should be permitted without having to go and fix it via custom script or etc. after every jail restart, I'm honestly trying to figure out why this is not the case as it seems to cause more problems than it prevents...

[mgob]

I've added a pull request to fix the stock template issues with LDAP/AD.

The file itself, with no modifications is broken for LDAP/AD configuration so, excluding the SSL/Static IP configuration, it's bad to begin with and needs modification if you want to use SSL outside of the included SSL/LE utilities for various reasons OR you want to use LDAP/AD.

Modification of this file should be permitted without having to go and fix it via custom script or etc. after every jail restart, I'm honestly trying to figure out why this is not the case as it seems to cause more problems than it prevents...